Summary:The assessment of COBIT process maturity levels for each COBIT
Software development is a complex endeavor that encompasses application and implementation layers with functional (refers to what is done) and non-functional (how is done) aspects. The efforts to scale agile software development practices are not wholly able to address issues such as integrity, which is a crucial non-functional aspect of the software development process. However, if we consider most software failures are Byzantine failures (i.e., where components may fail and there is imperfect information on which a component has failed.) that might impair the operation but do not completely disable the production line. In this paper, we assume software practitioners who cause defects as Byzantine participants and claim that most software failures can be mitigated by viewing software development as the Byzantine Generals Problem. Consequently, we propose a test-driven incentive mechanism based on a blockchain concept to orchestrate the software development process where production is controlled by a similar infrastructure based on the working principles of blockchain. We discuss the model that integrates blockchain with the software development process, and provide some recommendations for future work to address the issues while orchestrating software production.
The SOQRATES (www.soqrates.de) working party has been established in 2003 with the support of the Bavarian SW initiative. Major automotive suppliers joined forces to exchange best practices in topics such as Automotive SPICE, functional safety, and cybersecurity.The research method of SOQRATES is to compare the best practices, and in case that a specific design pattern is accepted by all parties, it is declared and published as a state of the art.Some of the results of the working party have been packaged into training courses.For example, in the EU project SafEUr (518632-LLP-1-2011-1-AT-LEONARDO-LMP, 2011-2012) a European partnership with inputs from SOQRATES developed a skill set, training materials, and best practices for the implementation of ISO 26262.For example, in the EU project AQUA (Knowledge Alliance for Quality in Automotive, EAC-2012EAC- -0635, 2013EAC- -2014, a European partnership with inputs from SOQRATES developed a skill set, training materials, and best practices for integrating Automotive SPICE, ISO 26262, and Six Sigma.For example, in the EU project AQU (Automotive Quality Universities, 2015-1-CZ01-KA203-013986, 2015-2017), a European partnership with inputs from SOQRATES applied the AQUA concept with universities in Austria, Germany, France, and Czech Republic who educate students that will work in the automotive industry.Also, the working party elaborated integrated assessment models where the Automotive SPICE 3.0 has been merged with ISO 26262 (further safety related questions) and SAE J3061 (further cybersecurity questions). This paper will look into the future of self-driving cars and discuss the design patterns that are currently analysed in the working party to support a vehicle in future self-driving infrastructure architectures and processes. KEYWORDSAutomotive SPICE, cybersecurity, functional safety, ISO 26262, SAE J3061, service architectures for automotive 1 | INTRODUCTION ADAS stands for Autonomous Driving Assistance Systems and realises functions that support the driver but still keep the driver in the flow. It is still expected that there is a driver with a driver licence who is part of the control flow. From 2030 on the plans from OEMs are to produce self-driving cars where there are no drivers, the passenger is a person that is provided with a mobility service. The car itself must control the situation (supported by infrastructure), and also the insurance model will have been changed by then. Cars will have a black box that logs all vehicle data from all electronic control units (ECUs) and insurance will go with the car and the component, and will not be on the driver as a person any more.In case of the steering example in this paper, the authors also outline the future of a self-driving scenario.Automotive companies experience an exponential increase in functional development. Major car manufacturers develop vehicle functions that can be decomposed into features (functions) on ECU and supplier level. A real time communication (via a bus) of a set of electronic control units ...
No abstract
2016 saw cybersecurity standards appear in both automotive and medical device industries. Both standards are understandably based on processes that already exist in the respective industries. The automotive J3061 1 standard is very much focussed on existing categories for defining the cybersecurity threats, ie, systems, hardware and software. Cybersecurity is very much a multifaceted topic, and by restricting the scope to these 3 subject areas there is the risk that many significant threats could be overlooked, in particular the malicious acts of employees within an organisation.The medical cybersecurity report AAMI TIR 57 2 takes the approach based on ISO 14971 3 the medical device risk management standard, which encourages a more open-minded approach to evaluating cybersecurity threats. Both of these documents, which are discussed in this paper, are short of practical examples or techniques for assessing and mitigating threats; the topic is handled in a more theoretical manner.Key issues such as trojan circuits in microcontrollers are not well represented in either document. Generally, software topics such as authentication and encryption are given good coverage in international standards; however, this not the case when reviewing hardware concerns. Both TIR 57 and J3061 are good starting documents for the topic of cybersecurity, but both could benefit from expansion to cover the wider topics affecting cybersecurity. KEYWORDS cybersecurity, risk model, sabotage, threat, trojan circuits | INTRODUCTIONIn 2016, 2 of the main safety-related industries introduced key guidance documents on cybersecurity. This paper looks at the different ways that both address the subject and also looks at potential gaps left by the guidance documents in this complex subject area. This paper compares the 2 cybersecurity standards and attempts to assess the pros and cons of both. Ultimately, the aim here is not to define new findings in the field of cybersecurity but to establish the strengths and weaknesses of international standards addressing cybersecurity.In January 2016, the SAE International released J3061 Cybersecurity Guidebook for Cyber-Physical Vehicle Systems 1 and 6 months later the Association for the Advancement of Medical Instrumentation approved the technical information report TIR 57 Principles for medical device security-risk management. 2 Both these documents approach the subject using the existing process structure within the respective industries, and this results in a marked difference in the approaches, for what is a relatively similar problem. | THE CYBERSECURITY PRINCIPLESThe protection of personally identifiable information, ie, any information that can be used to distinguish or trace an individual's identity, is the key aim of cybersecurity and both standards were compared in this paper.The approach the 2 industries take to post-production activities is quite different. Medical device life-cycle is better adapted to monitoring postproduction activities. 6,7 Post-market surveillance is a key activity in the i...
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.
hi@scite.ai
10624 S. Eastern Ave., Ste. A-614
Henderson, NV 89052, USA
Copyright © 2024 scite LLC. All rights reserved.
Made with 💙 for researchers
Part of the Research Solutions Family.